Subject: [mobile-ip] issues in mipv6-ipsec: DHAAD

From: Jari Arkko <[email-masked]>
Date: Fri, 27 Sep 2002 16:09:19 +0300

Since both DHAAD and prefix discovery use ICMP messages, the
DHAAD response packets from the home agent to the mobile node look exactly
like prefix discovery from the point of view of IPsec. Yet, the
policies for DHAAD and prefix discovery are different (pass and protect,
respectively).

Note that the anycast DHAAD request is not automatically
protected, as the anycast address isn't in the SPD as
we proposed it.

Some ideas on how to deal with this:

- Prefix discovery MUST use (an existing) home address
   and DHAAD MUST use care-of address.

   The home agent MUST verify that it does not
   respond to a prefix discovery request to an address
   which is not a home address. This ensures that the
   SPD prevents prefix information from leaking (since
   it contains all home addresses and ICMP). Any problems
   in making the prefix discovery use home addresses?

   DHAAD goes to care-of address, and is not protected.

- Protect both DHAAD responses and prefix discovery,
   i.e., ICMP is protected to all addresses. Appears
   to require IKE, as otherwise the SAs to all
   possible addresses can't be established.

- ICMP type specific selectors are required.

- Something else, what?

Jari

---

From: Vladislav Yasevich <[email-masked]>
Date: Fri, 27 Sep 2002 09:42:31 -0400

>   DHAAD goes to care-of address, and is not protected.

Agree.  Also, should the draft clarify that HAO an RH2 are
not used in the DHAAD exchange?

-vlad
-
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Vladislav Yasevich		Tru64 UNIX - IPv6 Project Lead
Hewlett Packard 		Tel: (603) 884-1079
Nashua, NH 03062		ZKO3-3/T07

---

From: Francis Dupont <[email-masked]>
Date: Sat, 28 Sep 2002 15:34:17 +0200

Since both DHAAD and prefix discovery use ICMP messages,

=> as there are not essential (IMHO they should be removed)
I think we should throw them in an annex.

   - Something else, what?
   
=> see above

[email-masked]

PS: I really suggest we put our efforts on essential things:
we have not two different implementations with support of
the MN-HA bidir tunnel with automatic IPsec protection for
the home registration...